search

InQuest / iocextract

Defanged Indicator of Compromise (IOC) Extractor.
https://inquest.readthedocs.io/projects/iocextract/
GNU General Public License v2.0
505 stars 91 forks source link

URLs pulling in IPs #34

Closed punkrokk closed 1 year ago

punkrokk commented 5 years ago

If I have a URL with a port - e.g. 1.1.1.1:449 I'm seeing a URL getting extracted in the format of: http://1.1.1.1:449.

Is that desired behavior?

punkrokk commented 4 years ago

bump

luis261 commented 3 years ago

I have the same problem, even if no port is given, if the IP is defanged. grafik

battleoverflow commented 1 year ago

Hi, @punkrokk!

This issue is now resolved and available in the develop branch. I will send another comment here once a new version is available for download from PyPI.

Here's an example with the new code:

import iocextract

def extract_no_scheme_urls():
    url = "1[.]1[.]1[.]1:443"
    print(list(iocextract.extract_urls(url, refang=True, no_scheme=True)))

extract_no_scheme_urls()
battleoverflow commented 1 year ago

New version is now available on PyPI: https://pypi.org/project/iocextract/1.14.0/

luis261 commented 1 year ago

New version is now available on PyPI: https://pypi.org/project/iocextract/1.14.0/

@azazelm3dj3d while it seems like the bug originally referenced in this issue is fixed in the new version, the one I commented above still exists. Defanged IPs still get extracted by extract_urls while their non-defanged counterparts don't